public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

SMACK: Add sk_clone_security LSM hook

Browse source 
Using smk_of_current() during sk_alloc_security hook leads in
rare cases to a faulty initialization of the security context
of the created socket.

By adding the LSM hook sk_clone_security to SMACK this initialization
fault is corrected by copying the security context of the old socket
pointer to the newly cloned one.

Co-authored-by: Martin Ostertag: <martin.ostertag@elektrobit.com>
Signed-off-by: Lontke Michael <michael.lontke@elektrobit.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
This commit is contained in:
Lontke Michael 2022-08-31 14:03:26 +02:00 • committed by Casey Schaufler
parent b90cb10531
commit 4ca165fc6c
1 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
security/smack/smack_lsm.c
View file

@ -2278,6 +2278,21 @@ static void smack_sk_free_security(struct sock *sk)
kfree(sk->sk_security); kfree(sk->sk_security);
} }
/**
* smack_sk_clone_security - Copy security context
* @sk: the old socket
* @newsk: the new socket
*
* Copy the security context of the old socket pointer to the cloned
*/
static void smack_sk_clone_security(const struct sock *sk, struct sock *newsk)
{
struct socket_smack *ssp_old = sk->sk_security;
struct socket_smack *ssp_new = newsk->sk_security;
*ssp_new = *ssp_old;
}
/** /**
* smack_ipv4host_label - check host based restrictions * smack_ipv4host_label - check host based restrictions
* @sip: the object end * @sip: the object end
@ -4851,6 +4866,7 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(socket_getpeersec_dgram, smack_socket_getpeersec_dgram), LSM_HOOK_INIT(socket_getpeersec_dgram, smack_socket_getpeersec_dgram),
LSM_HOOK_INIT(sk_alloc_security, smack_sk_alloc_security), LSM_HOOK_INIT(sk_alloc_security, smack_sk_alloc_security),
LSM_HOOK_INIT(sk_free_security, smack_sk_free_security), LSM_HOOK_INIT(sk_free_security, smack_sk_free_security),
LSM_HOOK_INIT(sk_clone_security, smack_sk_clone_security),
LSM_HOOK_INIT(sock_graft, smack_sock_graft), LSM_HOOK_INIT(sock_graft, smack_sock_graft),
LSM_HOOK_INIT(inet_conn_request, smack_inet_conn_request), LSM_HOOK_INIT(inet_conn_request, smack_inet_conn_request),
LSM_HOOK_INIT(inet_csk_clone, smack_inet_csk_clone), LSM_HOOK_INIT(inet_csk_clone, smack_inet_csk_clone),